diff --git a/README.md b/README.md
index 9b7b18f..84ff4c5 100644
--- a/README.md
+++ b/README.md
@@ -118,7 +118,7 @@ flowchart LR
 ```
 Solid arrows are real dependencies; dotted arrows are asynchronous telemetry reporting, not a blocking dependency. Full breakdown of all 8 traffic laws (ingress, east-west, secrets, DNS, observability, notifications, CI/CD, management) with the actual trust-boundary reasoning: [docs/architecture-overview.md](docs/architecture-overview.md).
 
-## Systems
+## **## Systems**
 
 ### 🔐 Secrets & PKI
 A self-hosted Vault cluster is both the certificate authority and the secret store for every host in the fleet — every TLS certificate, every database password, every API key traces back to this one system. Nothing reaches Vault directly; a local agent on each host authenticates itself and renders what that host needs to disk. Replaced an earlier setup where secrets sat in plaintext inside git.